Section 10 — Additional obligations of Significant Data Fiduciary

What this section requires

The Central Government can notify any Data Fiduciary, or class of them, as a Significant Data Fiduciary — based on factors like the volume and sensitivity of personal data processed, risk to Data Principals' rights, and potential impact on India's sovereignty, electoral integrity, State security, or public order.

Once notified, a Significant Data Fiduciary carries three extra duties beyond ordinary Chapter II obligations: appoint a Data Protection Officer who is based in India, represents the SDF under the Act, answers directly to its board or governing body, and is the grievance-redressal point of contact; appoint an independent data auditor to evaluate its compliance; and run periodic Data Protection Impact Assessments and periodic audits, plus any other prescribed measures.

Who it applies to

Only Data Fiduciaries the Central Government has specifically notified as Significant Data Fiduciaries — this is not a self-assessed status, and it doesn't attach automatically at any size or revenue threshold.

Checklist

• Confirm whether the Central Government has actually notified your organisation as an SDF before treating any of this as applicable — it's a designation, not a self-test.
• If notified: appoint an India-based Data Protection Officer answering to the board, not to a business unit.
• Appoint an independent data auditor — independent of the function being audited, not an internal reviewer.
• Run periodic Data Protection Impact Assessments covering Data Principal rights, purpose of processing, and risk management.
• Run periodic compliance audits, and whatever additional measures Rule 13 prescribes once in force.

Penalty exposure

Breach of an SDF's additional obligations under Section 10 carries a monetary penalty of up to ₹150 crore, per item 4 of the Schedule to Section 33.

Implementation timeline

Not yet in force. Commences 13 May 2027, eighteen months after the DPDP Rules, 2025 were published (13 November 2025) — per the commencement notification G.S.R. 843(E).